How to Root the Onyx Boox Tab Ultra C 
(using Windows 11) 


Introduction 

| previously created a this guide for the Note Air 2 Plus on MobileRead. This is the same thing, but for 
the Tab Ultra C. It took me a while to figure out the rooting process the first time. In hopes of saving 
others time, | documented the steps and turned them up into an easy-to-understand tutorial. | do not 
have developer’s experience and know just enough to stumble my way through commands. All the hard 
work to accomplish this was completed by people with more knowledge than | have. | am simply 
providing instructions and sources. 


If you give this guide a run-through, please provide feedback on any errors you find or changes that 
could be made. Keep in mind | will not be able to answer more technical questions, but perhaps 
someone else will chime in on the thread if needed. 


Assumptions 
My knowledge and setup for this guide is below. If your level of knowledge or setup is different your 
results may vary. 

- _|own an Onyx Boox Tab Ultra C. 

- My device is running firmware version 2023-06-09 15-57 3.3.2 

- |have administrative access to a PC. 

- My PCis running Windows 11 Pro (22H2). 

- | know how to access Windows Command Prompt and run basic commands. 

- | have the patience to search and troubleshoot for hours... days... 


Prerequisites 
It will be helpful to take care of these first. 


1. Download and run the “15 Seconds ADB Installer”. 
a. |had to use v1.3.0 for ADB to work properly on my PC. The latest versions give an error 
when trying to install systemwide. 
b. When asked, “Install ADB system-wide”, choose “Y”. 
c. When asked, “Do you want to install device drivers”, choose “Y”. 

i. Install the driver using the Device Driver Installation Wizard that pops up. 

d. What is the “15 Seconds ADB Installer”? This easy-to-use installer will quickly put two 
essential tools on your PC: ADB and Fastboot. 

i. ADB= Android Debug Bridge. ADB lets you connect your development 
workstation directly to your Android device so you can install packages and 
evaluate your changes. [source] 

ii. Fastboot is three different things with the same name: A protocol for 
communication between your device hardware and a computer, software that 


runs on the device when in Fastboot mode, and the executable file on the 
computer you use to make them talk to each other. [source] 
2. Download and install “EDL Utility” (Thank you, Renate!). 
a. | placed the “edl.exe” executable file in my user folder for easy Command Prompt 
access. For me that was “C:\Users\<myuserfolder>”. 
b. What is “EDL Utility”? This is a custom executable Renate created for Windows. The 


alternative would be using this tool that requires python and has caused many 
headaches for me and others when using Windows. I’m sure it’s great, but | could not 
get it to work. 
i. EDL= Emergency Download. EDL follows a specific set of rules known as the 
Firehose or Sahara protocol to force-flash the firmware. [source] 
3. Download the latest version of “Magisk”. 

a. Look for and download the latest apk file (this is the app itself). You will sideload (install 
via ADB) this app onto your Tab Ultra C. 

b. Move the downloaded “Magisk-v26.1.apk” file (or whatever the current version is) to 
the folder “C:\adb” on your PC. This will make it easier to install later. 

c. What is the “Magisk App”? Magisk is an unofficial Android app, meaning Google doesn’t 
allow it in their Google Play Store. You will use this app to patch the boot image you pull 
from your Tab Ultra C, giving you root access. [source] 

4. Download “Qualcomm 662 Loader.zip”. Thank you, downeaster59! 

a. This zip file contains a loader that was provided by MobileRead user downeaster59. 
They mentioned that they do not remember where they found it, but it is the only 
loader that would work for them, and | had the same results. | tried many loaders found 
here, but none of them worked for my Note Air 2 Plus and this also worked for my Tab 
Ultra C. 

b. Unzip the loader file “662.elf” and place it in the same folder as Renate’s “EDL Utility”. 
For me that was “C:\Users\<myuserfolder>” 

c. What is a loader? If | understand correctly, this is the file that EDL mode will use to 
access the Bootloader, which is what you will need to flash your device. [source] 

5. Download the latest version of “Zadig”. 

a. Place this stand-alone utility wherever it is convenient to access. 

b. What is “Zadig’”? This utility will be used to easily install a generic USB driver for EDL 
mode. 

6. Download this Fastboot Driver. 

a. Unzip and save the “Fastboot driver” folder wherever it is convenient to access. You will 
be browsing for it later. 

b. What is this “Fastboot Driver”? Windows requires a driver to communicate with the Tab 
Ultra C in both the EDL mode and in the Fastboot mode. | could not find a Windows 
driver compatible with Fastboot mode until | found this site. 


Instructions 
Enable USB Debug Mode 


1. From your Tab Ultra C’s home screen, select the Gear icon in the dock at the bottom of the 
screen. 
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2. On the left-hand side, scroll down and select “System Settings”, then turn on “USB Debug 
Mode” by toggling the on/off switch to ON. This will allow you to communicate via Command 
Prompt over USB. 
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3. Plugin your Tab Ultra C to your PC via USB. You may hear a chime on your device and on your 
PC, indicating the PC recognized the device. 

4. On your PC, open Command Prompt. 

5. Run the following command to active the ADB daemon and check if your device is properly 
listed: 


6. You should see similar results in your Command Prompt: 


C:\Users\myuserfolder>adb devices 
* daemon not running. starting it now on port 5037 * 


* daemon started successfully * 
List of devices attached 
<yourdeviceid> unauthorized 
7. Your Tab Ultra C will prompt you to allow USB debugging from the PC you just plugged into. 
Choose “Allow”. Choose “Always allow from this computer” if you are working from a trusted PC 
and you don’t want to be prompted again. 
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8. Click on the Command Prompt, press the “up arrow” key on your keyboard to bring back the 
“adb devices” command and then run it again, you should now see “device” instead of 
“unauthorized”: 

C:\Users\myuserfolder>adb devices 


List of devices attached 
<yourdeviceid> device 


Sideload the Magisk Apk 
1. Make sure you have the Magisk apk in your “C:\adb” folder 
2. With your Tab Ultra C plugged into your PC, open Command Prompt and run the following 
command to change your directory: 
3. Next, run the following command to move Magisk to your Tab Ultra C (your Magisk version 
number may differ): 
4. You should see similar results in your Command Prompt: 
c:\adb>adb install Magisk-v26.1.apk 
2448 KB/s (11411692 bytes in 4.551s) 
Success 
5. You should now have the Magisk app on your Tab Ultra C’s Home screen. Mine was on the 
second page because the home screen was full. 


6. If you open the Magisk app, you will see that the Installed status at the top reads “N/A”. This will 
change once you have rooted the device. The Magisk app may also ask you to reboot your 
device. You can do so. 
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Install a Windows Driver for EDL Mode 


1. With your Tab Ultra C plugged into your PC, open Command Prompt and run the following 
command to enter EDL mode: 

2. Your device will now be in EDL mode. Your Tab Ultra C’s screen will show whatever was last on 
it, but it will be frozen in place. The screen lighting will turn off if it is on. This is expected. 

3. Now isthe time to open Zadig.exe. It should detect your Tab Ultra C as a device without a driver. 
The current driver will display “(NONE)”. The default driver it will choose to install should be 
“WinUSB v6.1.7600.16385”. If not, select that from the drop-down menu and click the “Install 
Driver” button. 
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4. The installation can take up to 5 minutes. Afterwards, you should receive a message that says, 
“The driver was installed successfully.” Close Zadig. 
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Retrieve a Boot Image with EDL and a Loader 
1. Make sure you have the “662.elf” file in the same folder as Renate’s EDL Utility. 
2. With your Tab Ultra C plugged into your PC, open Command Prompt and run the following 
command (unless you are still in EDL mode from the last step, then skip this step): 


adb reboot edl 


3. Next, run the following command to load the 662 loader: 


edl.exe /1662.elf 


4. You should see similar results in your Command Prompt: 
C:\Users\userfolder>edl.exe /1662.elf 
Found EDL 9008 
Serial: <yourserial> 
HWID: eeeeeeeeeQ@e088e8, QC: 801740e1, OEM: 8008, Model: 9@0e02 


Hash: d40eee56f3194665 -574109a39267724a-e7944134cd53cb76- 


7e293d3c40497955 
Sending 662.elf 100% Ok 
Waiting for Firehose... Ok 
5. Next, run the following command to grab the boot image from your Tab Ultra C: 


edl.exe /u /r /pboot_a boota.img /t 


6. You should see similar results in your Command Prompt: 


C:\Users\userfolder>edl.exe /u /r /pboot_a boota.img /t 
Found EDL 9008 
Configuring... Ok 
Requesting info... Ok 
Requesting GPT @ header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting GPT 1 header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting GPT 2 header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting GPT 3 header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting GPT 4 header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting GPT 5 header... Ok, receiving... requesting entries... 
Ok, receiving... Ok 
Requesting header... Ok, receiving... Ok 
Android2: 5875 / 24576 = 23.9% 
Requesting read boota.img... Ok, receiving 100% Ok 

7. You should now have a file on your PC called “boota.img” in the same folder as “edl.exe”. 


8. Reboot your Tab Ultra C by entering the following command: 


9. If the above command does not work for you, hold the power button down for about 10 
seconds. You will see the screen flash and then you can release the power button. Your Tab 
Ultra C can remain plugged into your PC while you do this. 


Patch the Boot Image with Magisk 
1. At this point your Tab Ultra C should be rebooted. 
2. On your Tab Ultra C, go back into Settings, System Settings, and disable USB Debug Mode. This 
will allow you to browse your device in Windows File Explorer. 
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3. In File Explorer, navigate to the Downloads folder on your Tab Ultra C. The path is “This PC\Tab 
Ultra C\Internal shared storage\Download”. 

4. Copy the boot image you obtained (“boota.img”) to this Download folder. 

5. On your Tab Ultra C, open the Magisk app and select the “Install” button at the top. 
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6. Next, select the “Select and Patch a File” radio button. 
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7. You will be taken to a list of the files on your device. Select your “boota.img’” file. 
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8. You will be taken back one screen, select the “LET’S GO” button. 
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9. Magisk will create a patched image in your Tab Ultra C’s Download folder. Mine was called 
“magisk_patched-26100_GiizA.img” but yours will vary. | had to unplug and re-plug my Tab Ultra 
C into my PC for this file to show up in Windows Explorer. You may need to do that. 
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10. Copy your patched image back to your PC and place it in your “C:\adb” folder. 

11. You can rename this patched image to whatever you want. For simplicity and archival purposes, 
| renamed mine to “boota_patched.img” 

12. On your Tab Ultra C enable USB Debug Mode again. You will need this for loading the patched 
image onto your Tab Ultra C via Command Prompt. 


Install a Windows Driver for Fastboot Mode 


1. With your Tab Ultra C plugged into your PC, open Command Prompt and run the following 
command to enter Bootloader: 

2. Your Tab Ultra C will reboot into Bootloader mode. You should see the Onyx logo on the device’s 
screen and the screen lighting will turn off if it is on. 


3. On your PC, right-click on your Windows Start Menu and select Device Manager. Look for a 
device with a yellow warning symbol. It could be call “Android”. Right-click that device and 
select “Update driver” from the menu. 
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4. Select “Browse my computer for drivers” and then select the “Browse...” button to navigate to 
your “Fastboot driver’ folder mentioned in the Prerequisites. 
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5. If you receive the message that the best driver is already installed, you will need to choose the 
option “Let me pick from a list of available drivers on my computer”, then the “Have Disk...” 


button and navigate to the “Fastboot driver” that way. 
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6. Once you have installed the driver, Windows may request a reboot. If Windows prompts you to 
do so, do this while your Tab Ultra C is still in Bootloader mode. | believe it is necessary to make 


the driver installation work. 


Test the Patched Boot Image 
1. Once your PC is rebooted, run the following command to change your directory: 


cd c:\adb 


2. Next, run the following command to temporarily load the patched image on your Tab Ultra C: 
3. You should see similar results in your Command Prompt: 

c:\adb>fastboot boot boota_ patched. img 

downloading 'boot.img'... 

OKAY [ @.5@2s] 


booting... 
OKAY [ @.141s] 
finished. total time: @.643s 
4. Your Tab Ultra C will automatically reboot and should be temporarily rooted until the next 
device reboot. You can check by opening the Magisk app and looking for “Installed”. It should 


now read “26.1 (26100)” instead of “N/A”. 
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5. If everything looks good on your Tab Ultra C, move on to the final step below. 


Flash the Patched Boot Image 
1. Run the following command to change your directory (unless you are still in EDL mode from the 


last step, then skip this step): 


cd c:\adb 


2. Run the following command to boot into the bootloader: 


adb reboot bootloader 


3. Run the following command to flash your Tab Ultra C with the patched image: 
4. You should see similar results in your Command Prompt: 
c:\adb>fastboot flash boot boota_patched. img 
target reported max download size of 804268032 bytes 
sending 'boot' (23500 KB)... 


OKAY [ @.5@2s] 

writing ‘boot’... 

OKAY [ @.22@s] 

finished. total time: @.721s 


Run the following command to reboot your device: 


fastboot reboot 


Your Tab Ultra C will reboot and should now be fully rooted. You can check by opening the 
Magisk app again and looking for “Installed”. It should now read “26.1 (26100)” instead of 
“N/A”. 

Congratulations, you did it! (I hope.) 


--END-- 


